Loading npm security reports…

yu-method@1.1.1: AI-agent control-surface risk | LPM Firewall

registry / yu-method / 1.1.1

yu-method@1.1.1

YU-METHOD — personal agile AI development skills built on BMAD-METHOD with customizable hooks

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall changes global AI-agent skill and instruction surfaces without an explicit user command. It also installs and registers additional tools and dependencies.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package runs postinstall automatically.

Impact

A package installation can alter future Claude and Codex behavior and add an MCP server command to the user's configuration.

Mechanism

Global AI-agent skill deployment and instruction-file rule injection.

Policy narrative

On npm installation, package.json invokes scripts/install.js. The script copies its skills into global directories for multiple AI agents, installs bmad-method non-interactively into the home directory, optionally globally installs CodeGraph, and registers an MCP server in ~/.claude.json. It then appends rules to Claude and Codex instruction files that direct automatic invocation of its skills before user messages. These changes occur without an explicit setup command and modify broad, behavior-bearing agent control surfaces.

AI rationale

The automatic postinstall performs broad mutation of foreign AI-agent configuration and instruction files, plus package-manager installs. This is a concrete unconsented agent-control hijack under the install lifecycle policy.

Evidence

package.jsonscripts/install.js~/.claude/skills~/.agents/skills~/.codex/skills~/.claude.json~/.claude/CLAUDE.md~/.codex/AGENTS.md~/AGENTS.md

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/brain-setup.jsView file

6const os = require('os'); L7: const { spawnSync } = require('child_process'); L8: const readline = require('readline');

High

Child Process

Package source references child process execution.

scripts/brain-setup.jsView on unpkg · L6

scripts/install.jsView file

8L9: const CLAUDE_SKILLS_DIR = path.join(os.homedir(), '.claude', 'skills'); L10: const AGENTS_SKILLS_DIR = path.join(os.homedir(), '.agents', 'skills'); L11: const CODEX_SKILLS_DIR = path.join(os.homedir(), '.codex', 'skills'); L12: const OWN_SKILLS_DIR = path.join(__dirname, '..', 'skills'); ... L16: function copyDir(src, dest) { L17: fs.mkdirSync(dest, { recursive: true }); L18: for (const entry of fs.readdirSync(src, { withFileTypes: true })) { ... L21: if (entry.isDirectory()) copyDir(srcPath, destPath); L22: else fs.copyFileSync(srcPath, destPath); L23: } ... L40: c = c.replace(/^document_output_language:\s*.+$/m, 'document_output_language: Chinese');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L8

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node 'use strict'; const fs = require('fs'); const path = require('path'); const os = require('os'); const { spawnsync } = require('child_process'); const claude_skills_dir = path.join(os.homedir(), '.claude', 'skills'); const agents_skills_dir = path.join(os.homedir(), '.agents', 'skills'); const codex_skills_dir = path.join(os.homedir(), '.codex', 'skills'); const own_skills_dir = path.join(__dirname, '..', 'skills'); const bmad_sentinel = path.join(claude_skills_dir, 'bmad-dev-story'); function copydir(src, dest) { fs.mkdirsync(dest, { recursive: true }); for (const

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install.jsView on unpkg

74// Always installs into os.homedir() so the location is stable regardless of L75: // which directory the user ran `npm install -g` from. L76: // On upgrades the sentinel already exists → skip (skills were promoted on first run). ... L78: console.log('Installing bmad-method core (first-time setup on this machine)...'); L79: const result = spawnSync( L80: 'npx',

scripts/session-end-hook.shView file

•path = scripts/session-end-hook.sh kind = build_helper sizeBytes = 1150 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/session-end-hook.shView on unpkg

scripts/brain-setup.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/brain-setup.js#virtual:normalized:round1View on unpkg